socks5systemz | 4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357

General

Target

4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.exe
Size

4.2MB
MD5

522c9cd1aef2a67f0abede20accec8f2
SHA1

ed2c850b7d68a3f9982b0b7c28e0ad17a11a7a97
SHA256

4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357
SHA512

e7bdf05073fa1c02cda90d30007cdfbbf580ca3bf36fb4cedf13571929fea3dae9f19d2edaed622cf9f725af496f746e819a50084b59324d80a5e49ea685a254
SSDEEP

98304:IH5qLmoqmydlOOcLlY9hr088srRepwVu1SoEa3:RaoVydlOOcLl0Q8zrRepws1SpO

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/5076-101-0x0000000000980000-0x0000000000A22000-memory.dmp	family_socks5systemz
behavioral2/memory/5076-126-0x0000000000980000-0x0000000000A22000-memory.dmp	family_socks5systemz
behavioral2/memory/5076-127-0x0000000000980000-0x0000000000A22000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz

Executes dropped EXE 2 IoCs

pid	Process
1452	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp
5076	softartsvc.exe

Loads dropped DLL 1 IoCs

pid	Process
1452	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	softartsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1452	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp
1452	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1452	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1452	4864	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.exe	84
PID 4864 wrote to memory of 1452	4864	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.exe	84
PID 4864 wrote to memory of 1452	4864	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.exe	84
PID 1452 wrote to memory of 5076	1452	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp	87
PID 1452 wrote to memory of 5076	1452	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp	87
PID 1452 wrote to memory of 5076	1452	4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp	87

C:\Users\Admin\AppData\Local\Temp\4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.exe
"C:\Users\Admin\AppData\Local\Temp\4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\is-PVI64.tmp\4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PVI64.tmp\4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp" /SL5="$A01C2,4111243,54272,C:\Users\Admin\AppData\Local\Temp\4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Users\Admin\AppData\Local\SoftArts Video Converter\softartsvc.exe
    "C:\Users\Admin\AppData\Local\SoftArts Video Converter\softartsvc.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SoftArts Video Converter\softartsvc.exe

Filesize
2.7MB

MD5
412d19bc62aaba785033e9f328319135

SHA1
5f8cc833c55e33bd3356e7943dbc73cdf5161e19

SHA256
b5a3394c9f289f2860521ab86d92f83cb545aa20af1d8e128912da017b5e46e1

SHA512
c0ba903d95592b7d1b9ce64fa35b11b98cd36221c19892523486e3530b41e3464eace96bdae7766e338969d6b1e4d27bac9b3529244e55b162d3af074291b8f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-472ON.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PVI64.tmp\4d723d67319936c52c38602dccfa40c1a1dff059f9f1ba84c4d041aea1852357.tmp

Filesize
689KB

MD5
6d0c2bc2bff4f7aba3e09fa58c2439b2

SHA1
0793aa92df5dd0f8780e0ba7ce56dc03e9ee736a

SHA256
315d03b6721fb892af4840831459c937733643c67c463a197f6ad0d7bf131b89

SHA512
643f04a92f3f7e10cb4812227a21d503a8c271858b37826413c6987ed9094eb1e40417e522a865135efd1795cc7b88b6624990590fa6859986d1548d01ace4c9

Download Submit
memory/1452-81-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1452-7-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4864-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4864-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4864-82-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5076-91-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-108-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-77-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-85-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-84-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-88-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-76-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-94-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-97-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-101-0x0000000000980000-0x0000000000A22000-memory.dmp

Filesize
648KB

Download
memory/5076-102-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-80-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-109-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-112-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-113-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-116-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-119-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-122-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-125-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-126-0x0000000000980000-0x0000000000A22000-memory.dmp

Filesize
648KB

Download
memory/5076-127-0x0000000000980000-0x0000000000A22000-memory.dmp

Filesize
648KB

Download
memory/5076-131-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download
memory/5076-134-0x0000000000400000-0x00000000006C0000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing